Bump github.com/VictoriaMetrics/VictoriaMetrics from 1.140.0 to 1.147.0

[dependabot]

Bumps github.com/VictoriaMetrics/VictoriaMetrics from 1.140.0 to 1.147.0.

Release notes

Sourced from github.com/VictoriaMetrics/VictoriaMetrics's releases.

v1.147.0

v1.147.0

Released at 2026-07-03

• SECURITY: upgrade base docker image (Alpine) from 3.23.4 to 3.24.1. See Alpine 3.24.1 release notes.

• FEATURE: vmauth: add default_vm_access_claim field into jwt section of auth config. It could be used at JWT claim placeholders, if JWT token doesn't have vm_access claim. See #11054.

• FEATURE: vmagent: reduces CPU usage by 10% at sharding among remote storages. See #11113. Thanks to @​bennf for contribution.

• FEATURE: vmagent, vminsert in VictoriaMetrics cluster and vmsingle: introduce 64KiB size limit for metric metadata fields - Unit, Help and MetricFamilyName. See #11128.

• FEATURE: vmagent and vmsingle: reduce CPU usage for storing scrape target labels. See #10919.

• FEATURE: vmsingle and vmselect in VictoriaMetrics cluster: add optimize_repeated_binary_op_subexprs=1 query arg to /api/v1/query_range for executing binary operator sides sequentially when they share the same optimized aggregate rollup result expression. This allows the second side to reuse rollup result cache populated by the first side. See #10575. Thanks to @​xhebox for the contribution.

• FEATURE: vmauth: prevent possible password brute-force attacks with an artificial 2-3 second delay as recommended by OWASP. See #11180.

• FEATURE: alerts: add InvalidAuthTokenRequestErrors alerting rule to vmauth alerts. The new rule notifies when vmauth receives requests with invalid or missing auth tokens, which may indicate a client misconfiguration, expired token use, or brute-force attack. See #11180.

• FEATURE: vmsingle: Add the support of vmselect RPC to vmsingle so that single node can be queried by a vmselect from a vmcluster deployment. See 4328, 10926, and the documentation.

• FEATURE: vmauth: allow log requests with missing or invalid auth tokens to access log. This is useful for identifying remote_addr IPs performing brute-force attacks. See #11180.

• FEATURE: vmauth: fall through to unauthorized_user when a JWT token has no vm_access claim and no default_vm_access_claim is configured. Previously, vmauth returned 401 Unauthorized immediately in this case, which prevented unauthorized_user from handling such requests. See #5740.

• FEATURE: MetricsQL: improve the selection algorithm of buckets_limit to remove consecutive empty buckets at the beginning and end to obtain more accurate min and max values. See #10417.

• FEATURE: vmalert: expose vmalert_group_rule_results_limit metric to indicate the number of alerts or recording results that a single rule within the group can produce. See #11179. Thanks to @​vinyas-bharadwaj for the contribution.

• FEATURE: alerts: add AlertingRuleResultsApproachingLimit and RecordingRuleResultsApproachingLimit alerting rules to vmalert alerts. These alerts notify when a rule's last evaluation samples exceed 90% of the configured group results limit. See #11179. Thanks to @​vinyas-bharadwaj for the contribution.

• BUGFIX: all VictoriaMetrics components: cancel in-flight HTTP requests shortly before -http.maxGracefulShutdownDuration elapses during graceful shutdown, so they can drain and the shutdown completes cleanly within that window instead of timing out and exiting via logger.Fatalf -> os.Exit. This prevents skipping the storage flush and losing in-memory data when long-lived requests are in flight (such as VictoriaLogs live tailing). See #1502.

• BUGFIX: vminsert in VictoriaMetrics cluster and vmsingle: properly check values range for the limits configured with flags -maxLabelsPerTimeseries, -maxLabelNameLen and -maxLabelValueLen. It must be in range 1..65535. See #11128.

• BUGFIX: vminsert in VictoriaMetrics cluster: fixes unexpected rare rerouting. See #11162.

• BUGFIX: vmselect in VictoriaMetrics cluster: propagate cache reset operation to selectNode when /internal/resetRollupResultCache is called. Previously, the propagation only happened when the delete_series API was called. See #11112.

• BUGFIX: stream aggregation: fix possible unexpected increases in rate_avg and rate_sum if an out-of-order sample is ingested after the previous flush. See #11140.

• BUGFIX: vmctl: properly URL-encode -vm-extra-label values when building import requests, so special characters such as & don't get split into broken query parameters. See #11144. Thanks to @​immanuwell for contribution.

• BUGFIX: enterprise vmagent: ignore enable.auto.offset.store option in kafka.consumer.topic.options, since vmagent manages offset storage internally. Previously, setting this option could cause vmagent to stop committing Kafka messages. See #11208.

v1.146.0

v1.146.0

Released at 2026-06-19

• FEATURE: all VictoriaMetrics components: add -http.header.disableServerHostname command-line flag for disabling the X-Server-Hostname HTTP response header. See #11067. Thanks to @​zasdaym for contribution.

• FEATURE: vmsingle and vmselect in VictoriaMetrics cluster: log calls to /api/v1/admin/tsdb/delete_series API handler. This should help to identify events of metrics deletion from the database. See #11104.

• FEATURE: vmctl: add -vm-headers and -vm-bearer-token flags for authenticating requests to the VictoriaMetrics import destination. The flags are available in opentsdb, influx, remote-read, prometheus, mimir, and thanos vmctl sub-commands. See #8897.

• FEATURE: vmui: add the last value to graph legend statistics. See #10759.

• FEATURE: stream aggregation: expose vm_streamaggr_dedup_dropped_samples_total to allow tracking dropped old samples during deduplication.

• FEATURE: stream aggregation: use the aggregation rule interval as the default staleness_interval instead of 2*interval, to reduce spikes when there are gaps between received samples. See #11102.

• FEATURE: vmagent: add a new flag -remoteWrite.inmemoryQueues to prioritize recently ingested data over historical data stored at file-based persistent queue. See #8833

• FEATURE: vmagent: add -promscrape.cluster.shardByLabels command-line flag for selecting target labels used for sharding scrape targets among vmagent instances in cluster mode. See #11044.

• FEATURE: vmctl: add -vm-headers and -vm-bearer-token flags for authenticating requests to the VictoriaMetrics import destination. The flags are available in opentsdb, influx, remote-read, prometheus, mimir, and thanos vmctl sub-commands. See #8897.

• FEATURE: vmsingle and vmselect in VictoriaMetrics cluster: log calls to /api/v1/admin/tsdb/delete_series API handler. This should help to identify events of metrics deletion from the database. See #11104.

• FEATURE: vmui: add the last value to graph legend statistics. See #10759.

• BUGFIX: enterprise vmsingle and vmstorage in VictoriaMetrics cluster: properly expose metric vm_retention_filters_partitions_scheduled_rows. See #11138

• BUGFIX: stream aggregation: fix issue with producing aggregated samples with identical timestamps between flushes. See #10808.

• BUGFIX: vmagent: fix potential corruption of remote-write metadata Unit values. See #11120. Thanks for @​fxrlv for the contribution.

• BUGFIX: vmalert,vmauth,vmagent and vmsingle: fix rare unbounded shutdown delay when config reload takes longer than -configCheckInterval. See #11107. Thanks to @​PleasingFungus for contribution.

... (truncated)

Commits

• 3ac6505 app/vmstorage: reduce memory allocations after 35488588437182958c1e2b758f62bb...
• dcf36b8 docs/changelog: cut release v1.147.0
• f6edd9d docs: update version to v1.147.0
• 22b58c7 app/vmselect: run make vmui-update
• 485f4c3 .golangci: exclude vmui node modules as linter checks .go files in it
• 83a9f73 app/vmalert: expose group results limit as a metric (#11182)
• 669de29 dashboards: sync uptime panel in vmsingle&vmagent dashboards with the other...
• 21119cd app/vmselect: buckets_limit: improve selection algorithm to remove consecuti...
• ebb0b5c app/vmauth: fall through to unauthorized_user when JWT token has no vm_access...
• f913a84 app/vmselect/promql: Improve code readability by using positive if clauses
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)